#include <linux/fs.h>
#include <linux/oom.h>
#include <sys/poll.h>
-#include <linux/seccomp-bpf.h>
#include <glob.h>
+#include <sys/personality.h>
#include <libgen.h>
+#undef basename
#ifdef HAVE_PAM
#include <security/pam_appl.h>
#endif
+#ifdef HAVE_SELINUX
+#include <selinux/selinux.h>
+#endif
+
+#ifdef HAVE_SECCOMP
+#include <seccomp.h>
+#endif
+
+#ifdef HAVE_APPARMOR
+#include <sys/apparmor.h>
+#endif
+
#include "execute.h"
#include "strv.h"
#include "macro.h"
#include "ioprio.h"
#include "securebits.h"
#include "namespace.h"
-#include "tcpwrap.h"
#include "exit-status.h"
#include "missing.h"
#include "utmp-wtmp.h"
#include "def.h"
-#include "loopback-setup.h"
#include "path-util.h"
-#include "syscall-list.h"
#include "env-util.h"
#include "fileio.h"
#include "unit.h"
#include "async.h"
+#include "selinux-util.h"
+#include "errno-list.h"
+#include "af-list.h"
+#include "mkdir.h"
+#include "apparmor-util.h"
+#include "smack-util.h"
+#include "bus-kernel.h"
+#include "label.h"
+#include "cap-list.h"
+
+#ifdef HAVE_SECCOMP
+#include "seccomp-util.h"
+#endif
#define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
#define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
/* This assumes there is a 'tty' group */
#define TTY_MODE 0620
+#define SNDBUF_SIZE (8*1024*1024)
+
static int shift_fds(int fds[], unsigned n_fds) {
int start, restart_from;
if ((nfd = fcntl(fds[i], F_DUPFD, i+3)) < 0)
return -errno;
- close_nointr_nofail(fds[i]);
+ safe_close(fds[i]);
fds[i] = nfd;
/* Hmm, the fd we wanted isn't free? Then
- * let's remember that and try again from here*/
+ * let's remember that and try again from here */
if (nfd != i+3 && restart_from < 0)
restart_from = i;
}
return "/dev/console";
}
-void exec_context_tty_reset(const ExecContext *context) {
+static void exec_context_tty_reset(const ExecContext *context) {
assert(context);
if (context->tty_vhangup)
o == EXEC_OUTPUT_JOURNAL_AND_CONSOLE;
}
-void exec_context_serialize(const ExecContext *context, Unit *u, FILE *f) {
- assert(context);
- assert(u);
- assert(f);
-
- if (context->tmp_dir)
- unit_serialize_item(u, f, "tmp-dir", context->tmp_dir);
-
- if (context->var_tmp_dir)
- unit_serialize_item(u, f, "var-tmp-dir", context->var_tmp_dir);
-}
-
static int open_null_as(int flags, int nfd) {
int fd, r;
assert(nfd >= 0);
- if ((fd = open("/dev/null", flags|O_NOCTTY)) < 0)
+ fd = open("/dev/null", flags|O_NOCTTY);
+ if (fd < 0)
return -errno;
if (fd != nfd) {
r = dup2(fd, nfd) < 0 ? -errno : nfd;
- close_nointr_nofail(fd);
+ safe_close(fd);
} else
r = nfd;
r = connect(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
if (r < 0) {
- close_nointr_nofail(fd);
+ safe_close(fd);
return -errno;
}
if (shutdown(fd, SHUT_RD) < 0) {
- close_nointr_nofail(fd);
+ safe_close(fd);
return -errno;
}
+ fd_inc_sndbuf(fd, SNDBUF_SIZE);
+
dprintf(fd,
"%s\n"
"%s\n"
if (fd != nfd) {
r = dup2(fd, nfd) < 0 ? -errno : nfd;
- close_nointr_nofail(fd);
+ safe_close(fd);
} else
r = nfd;
if (fd != nfd) {
r = dup2(fd, nfd) < 0 ? -errno : nfd;
- close_nointr_nofail(fd);
+ safe_close(fd);
} else
r = nfd;
case EXEC_INPUT_TTY_FAIL: {
int fd, r;
- if ((fd = acquire_terminal(
- tty_path(context),
- i == EXEC_INPUT_TTY_FAIL,
- i == EXEC_INPUT_TTY_FORCE,
- false,
- (usec_t) -1)) < 0)
+ fd = acquire_terminal(tty_path(context),
+ i == EXEC_INPUT_TTY_FAIL,
+ i == EXEC_INPUT_TTY_FORCE,
+ false,
+ USEC_INFINITY);
+ if (fd < 0)
return fd;
if (fd != STDIN_FILENO) {
r = dup2(fd, STDIN_FILENO) < 0 ? -errno : STDIN_FILENO;
- close_nointr_nofail(fd);
+ safe_close(fd);
} else
r = STDIN_FILENO;
case EXEC_OUTPUT_JOURNAL_AND_CONSOLE:
r = connect_logger_as(context, o, ident, unit_id, fileno);
if (r < 0) {
- log_struct_unit(LOG_CRIT, unit_id,
- "MESSAGE=Failed to connect std%s of %s to the journal socket: %s",
- fileno == STDOUT_FILENO ? "out" : "err",
- unit_id, strerror(-r),
- "ERRNO=%d", -r,
- NULL);
+ log_unit_struct(unit_id,
+ LOG_CRIT,
+ LOG_MESSAGE("Failed to connect %s of %s to the journal socket: %s",
+ fileno == STDOUT_FILENO ? "stdout" : "stderr",
+ unit_id, strerror(-r)),
+ LOG_ERRNO(-r),
+ NULL);
r = open_null_as(O_WRONLY, fileno);
}
return r;
}
if (fd >= 2)
- close_nointr_nofail(fd);
+ safe_close(fd);
*_saved_stdin = saved_stdin;
*_saved_stdout = saved_stdout;
return 0;
fail:
- if (saved_stdout >= 0)
- close_nointr_nofail(saved_stdout);
-
- if (saved_stdin >= 0)
- close_nointr_nofail(saved_stdin);
-
- if (fd >= 0)
- close_nointr_nofail(fd);
+ safe_close(saved_stdout);
+ safe_close(saved_stdin);
+ safe_close(fd);
return r;
}
-_printf_attr_(1, 2) static int write_confirm_message(const char *format, ...) {
- int fd;
+_printf_(1, 2) static int write_confirm_message(const char *format, ...) {
+ _cleanup_close_ int fd = -1;
va_list ap;
assert(format);
vdprintf(fd, format, ap);
va_end(ap);
- close_nointr_nofail(fd);
-
return 0;
}
if (dup2(*saved_stdout, STDOUT_FILENO) < 0)
r = -errno;
- if (*saved_stdin >= 0)
- close_nointr_nofail(*saved_stdin);
-
- if (*saved_stdout >= 0)
- close_nointr_nofail(*saved_stdout);
+ safe_close(*saved_stdin);
+ safe_close(*saved_stdout);
return r;
}
static int ask_for_confirmation(char *response, char **argv) {
int saved_stdout = -1, saved_stdin = -1, r;
- char *line;
+ _cleanup_free_ char *line = NULL;
r = setup_confirm_stdio(&saved_stdin, &saved_stdout);
if (r < 0)
if (!line)
return -ENOMEM;
- r = ask(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
- free(line);
+ r = ask_char(response, "yns", "Execute %s? [Yes, No, Skip] ", line);
restore_confirm_stdio(&saved_stdin, &saved_stdout);
}
static int enforce_user(const ExecContext *context, uid_t uid) {
- int r;
assert(context);
/* Sets (but doesn't lookup) the uid and make sure we keep the
* capabilities while doing so. */
if (context->capabilities) {
- cap_t d;
+ _cleanup_cap_free_ cap_t d = NULL;
static const cap_value_t bits[] = {
CAP_SETUID, /* Necessary so that we can run setresuid() below */
CAP_SETPCAP /* Necessary so that we can set PR_SET_SECUREBITS later on */
/* Second step: set the capabilities. This will reduce
* the capabilities to the minimum we need. */
- if (!(d = cap_dup(context->capabilities)))
+ d = cap_dup(context->capabilities);
+ if (!d)
return -errno;
if (cap_set_flag(d, CAP_EFFECTIVE, ELEMENTSOF(bits), bits, CAP_SET) < 0 ||
- cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0) {
- r = -errno;
- cap_free(d);
- return r;
- }
-
- if (cap_set_proc(d) < 0) {
- r = -errno;
- cap_free(d);
- return r;
- }
+ cap_set_flag(d, CAP_PERMITTED, ELEMENTSOF(bits), bits, CAP_SET) < 0)
+ return -errno;
- cap_free(d);
+ if (cap_set_proc(d) < 0)
+ return -errno;
}
/* Third step: actually set the uids */
char **e = NULL;
bool close_session = false;
pid_t pam_pid = 0, parent_pid;
+ int flags = 0;
assert(name);
assert(user);
* daemon. We do things this way to ensure that the main PID
* of the daemon is the one we initially fork()ed. */
+ if (log_get_max_level() < LOG_PRI(LOG_DEBUG))
+ flags |= PAM_SILENT;
+
pam_code = pam_start(name, user, &conv, &handle);
if (pam_code != PAM_SUCCESS) {
handle = NULL;
goto fail;
}
- pam_code = pam_acct_mgmt(handle, PAM_SILENT);
+ pam_code = pam_acct_mgmt(handle, flags);
if (pam_code != PAM_SUCCESS)
goto fail;
- pam_code = pam_open_session(handle, PAM_SILENT);
+ pam_code = pam_open_session(handle, flags);
if (pam_code != PAM_SUCCESS)
goto fail;
* If this fails, ignore the error - but expect sd-pam threads
* to fail to exit normally */
if (setresuid(uid, uid, uid) < 0)
- log_error("Error: Failed to setresuid() in sd-pam: %s", strerror(-r));
+ log_error_errno(r, "Error: Failed to setresuid() in sd-pam: %m");
/* Wait until our parent died. This will only work if
* the above setresuid() succeeds, otherwise the kernel
/* If our parent died we'll end the session */
if (getppid() != parent_pid) {
- pam_code = pam_close_session(handle, PAM_DATA_SILENT);
+ pam_code = pam_close_session(handle, flags);
if (pam_code != PAM_SUCCESS)
goto child_finish;
}
r = 0;
child_finish:
- pam_end(handle, pam_code | PAM_DATA_SILENT);
+ pam_end(handle, pam_code | flags);
_exit(r);
}
return 0;
fail:
- if (pam_code != PAM_SUCCESS)
+ if (pam_code != PAM_SUCCESS) {
+ log_error("PAM failed: %s", pam_strerror(handle, pam_code));
err = -EPERM; /* PAM errors do not map to errno */
- else
+ } else {
+ log_error_errno(errno, "PAM failed: %m");
err = -errno;
+ }
if (handle) {
if (close_session)
- pam_code = pam_close_session(handle, PAM_DATA_SILENT);
+ pam_code = pam_close_session(handle, flags);
- pam_end(handle, pam_code | PAM_DATA_SILENT);
+ pam_end(handle, pam_code | flags);
}
strv_free(e);
/* This resulting string must fit in 10 chars (i.e. the length
* of "/sbin/init") to look pretty in /bin/ps */
- p = path_get_file_name(path);
+ p = basename(path);
if (isempty(p)) {
rename_process("(...)");
return;
rename_process(process_name);
}
-static int apply_seccomp(uint32_t *syscall_filter) {
- static const struct sock_filter header[] = {
- VALIDATE_ARCHITECTURE,
- EXAMINE_SYSCALL
- };
- static const struct sock_filter footer[] = {
- _KILL_PROCESS
- };
+#ifdef HAVE_SECCOMP
+
+static int apply_seccomp(const ExecContext *c) {
+ uint32_t negative_action, action;
+ scmp_filter_ctx *seccomp;
+ Iterator i;
+ void *id;
+ int r;
+
+ assert(c);
+
+ negative_action = c->syscall_errno == 0 ? SCMP_ACT_KILL : SCMP_ACT_ERRNO(c->syscall_errno);
+
+ seccomp = seccomp_init(c->syscall_whitelist ? negative_action : SCMP_ACT_ALLOW);
+ if (!seccomp)
+ return -ENOMEM;
+
+ if (c->syscall_archs) {
+
+ SET_FOREACH(id, c->syscall_archs, i) {
+ r = seccomp_arch_add(seccomp, PTR_TO_UINT32(id) - 1);
+ if (r == -EEXIST)
+ continue;
+ if (r < 0)
+ goto finish;
+ }
+
+ } else {
+ r = seccomp_add_secondary_archs(seccomp);
+ if (r < 0)
+ goto finish;
+ }
+
+ action = c->syscall_whitelist ? SCMP_ACT_ALLOW : negative_action;
+ SET_FOREACH(id, c->syscall_filter, i) {
+ r = seccomp_rule_add(seccomp, action, PTR_TO_INT(id) - 1, 0);
+ if (r < 0)
+ goto finish;
+ }
+
+ r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
+ if (r < 0)
+ goto finish;
+
+ r = seccomp_load(seccomp);
+
+finish:
+ seccomp_release(seccomp);
+ return r;
+}
- int i;
- unsigned n;
- struct sock_filter *f;
- struct sock_fprog prog = {};
+static int apply_address_families(const ExecContext *c) {
+ scmp_filter_ctx *seccomp;
+ Iterator i;
+ int r;
+
+ assert(c);
+
+ seccomp = seccomp_init(SCMP_ACT_ALLOW);
+ if (!seccomp)
+ return -ENOMEM;
- assert(syscall_filter);
+ r = seccomp_add_secondary_archs(seccomp);
+ if (r < 0)
+ goto finish;
- /* First: count the syscalls to check for */
- for (i = 0, n = 0; i < syscall_max(); i++)
- if (syscall_filter[i >> 4] & (1 << (i & 31)))
- n++;
+ if (c->address_families_whitelist) {
+ int af, first = 0, last = 0;
+ void *afp;
- /* Second: build the filter program from a header the syscall
- * matches and the footer */
- f = alloca(sizeof(struct sock_filter) * (ELEMENTSOF(header) + 2*n + ELEMENTSOF(footer)));
- memcpy(f, header, sizeof(header));
+ /* If this is a whitelist, we first block the address
+ * families that are out of range and then everything
+ * that is not in the set. First, we find the lowest
+ * and highest address family in the set. */
- for (i = 0, n = 0; i < syscall_max(); i++)
- if (syscall_filter[i >> 4] & (1 << (i & 31))) {
- struct sock_filter item[] = {
- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, INDEX_TO_SYSCALL(i), 0, 1),
- BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
- };
+ SET_FOREACH(afp, c->address_families, i) {
+ af = PTR_TO_INT(afp);
- assert_cc(ELEMENTSOF(item) == 2);
+ if (af <= 0 || af >= af_max())
+ continue;
- f[ELEMENTSOF(header) + 2*n] = item[0];
- f[ELEMENTSOF(header) + 2*n+1] = item[1];
+ if (first == 0 || af < first)
+ first = af;
- n++;
+ if (last == 0 || af > last)
+ last = af;
}
- memcpy(f + (ELEMENTSOF(header) + 2*n), footer, sizeof(footer));
+ assert((first == 0) == (last == 0));
- /* Third: install the filter */
- prog.len = ELEMENTSOF(header) + ELEMENTSOF(footer) + 2*n;
- prog.filter = f;
- if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0)
- return -errno;
+ if (first == 0) {
- return 0;
+ /* No entries in the valid range, block everything */
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 0);
+ if (r < 0)
+ goto finish;
+
+ } else {
+
+ /* Block everything below the first entry */
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 1,
+ SCMP_A0(SCMP_CMP_LT, first));
+ if (r < 0)
+ goto finish;
+
+ /* Block everything above the last entry */
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 1,
+ SCMP_A0(SCMP_CMP_GT, last));
+ if (r < 0)
+ goto finish;
+
+ /* Block everything between the first and last
+ * entry */
+ for (af = 1; af < af_max(); af++) {
+
+ if (set_contains(c->address_families, INT_TO_PTR(af)))
+ continue;
+
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 1,
+ SCMP_A0(SCMP_CMP_EQ, af));
+ if (r < 0)
+ goto finish;
+ }
+ }
+
+ } else {
+ void *af;
+
+ /* If this is a blacklist, then generate one rule for
+ * each address family that are then combined in OR
+ * checks. */
+
+ SET_FOREACH(af, c->address_families, i) {
+
+ r = seccomp_rule_add(
+ seccomp,
+ SCMP_ACT_ERRNO(EPROTONOSUPPORT),
+ SCMP_SYS(socket),
+ 1,
+ SCMP_A0(SCMP_CMP_EQ, PTR_TO_INT(af)));
+ if (r < 0)
+ goto finish;
+ }
+ }
+
+ r = seccomp_attr_set(seccomp, SCMP_FLTATR_CTL_NNP, 0);
+ if (r < 0)
+ goto finish;
+
+ r = seccomp_load(seccomp);
+
+finish:
+ seccomp_release(seccomp);
+ return r;
}
+#endif
+
static void do_idle_pipe_dance(int idle_pipe[4]) {
assert(idle_pipe);
- if (idle_pipe[1] >= 0)
- close_nointr_nofail(idle_pipe[1]);
- if (idle_pipe[2] >= 0)
- close_nointr_nofail(idle_pipe[2]);
+
+ safe_close(idle_pipe[1]);
+ safe_close(idle_pipe[2]);
if (idle_pipe[0] >= 0) {
int r;
fd_wait_for_event(idle_pipe[0], POLLHUP, IDLE_TIMEOUT2_USEC);
}
- close_nointr_nofail(idle_pipe[0]);
+ safe_close(idle_pipe[0]);
}
- if (idle_pipe[3] >= 0)
- close_nointr_nofail(idle_pipe[3]);
+ safe_close(idle_pipe[3]);
}
-int exec_spawn(ExecCommand *command,
- char **argv,
- ExecContext *context,
- int fds[], unsigned n_fds,
- char **environment,
- bool apply_permissions,
- bool apply_chroot,
- bool apply_tty_stdin,
- bool confirm_spawn,
- CGroupControllerMask cgroup_supported,
- const char *cgroup_path,
- const char *unit_id,
- int idle_pipe[4],
- pid_t *ret) {
+static int build_environment(
+ const ExecContext *c,
+ unsigned n_fds,
+ usec_t watchdog_usec,
+ const char *home,
+ const char *username,
+ const char *shell,
+ char ***ret) {
- _cleanup_strv_free_ char **files_env = NULL;
- int socket_fd;
- char *line;
- pid_t pid;
- int r;
+ _cleanup_strv_free_ char **our_env = NULL;
+ unsigned n_env = 0;
+ char *x;
- assert(command);
- assert(context);
+ assert(c);
assert(ret);
- assert(fds || n_fds <= 0);
- if (context->std_input == EXEC_INPUT_SOCKET ||
- context->std_output == EXEC_OUTPUT_SOCKET ||
- context->std_error == EXEC_OUTPUT_SOCKET) {
+ our_env = new0(char*, 10);
+ if (!our_env)
+ return -ENOMEM;
- if (n_fds != 1)
- return -EINVAL;
+ if (n_fds > 0) {
+ if (asprintf(&x, "LISTEN_PID="PID_FMT, getpid()) < 0)
+ return -ENOMEM;
+ our_env[n_env++] = x;
- socket_fd = fds[0];
+ if (asprintf(&x, "LISTEN_FDS=%u", n_fds) < 0)
+ return -ENOMEM;
+ our_env[n_env++] = x;
+ }
- fds = NULL;
- n_fds = 0;
- } else
- socket_fd = -1;
+ if (watchdog_usec > 0) {
+ if (asprintf(&x, "WATCHDOG_PID="PID_FMT, getpid()) < 0)
+ return -ENOMEM;
+ our_env[n_env++] = x;
- r = exec_context_load_environment(context, &files_env);
- if (r < 0) {
- log_struct_unit(LOG_ERR,
- unit_id,
- "MESSAGE=Failed to load environment files: %s", strerror(-r),
- "ERRNO=%d", -r,
- NULL);
- return r;
+ if (asprintf(&x, "WATCHDOG_USEC="USEC_FMT, watchdog_usec) < 0)
+ return -ENOMEM;
+ our_env[n_env++] = x;
}
- if (!argv)
- argv = command->argv;
+ if (home) {
+ x = strappend("HOME=", home);
+ if (!x)
+ return -ENOMEM;
+ our_env[n_env++] = x;
+ }
- line = exec_command_line(argv);
- if (!line)
- return log_oom();
+ if (username) {
+ x = strappend("LOGNAME=", username);
+ if (!x)
+ return -ENOMEM;
+ our_env[n_env++] = x;
- log_struct_unit(LOG_DEBUG,
- unit_id,
- "EXECUTABLE=%s", command->path,
- "MESSAGE=About to execute: %s", line,
- NULL);
- free(line);
+ x = strappend("USER=", username);
+ if (!x)
+ return -ENOMEM;
+ our_env[n_env++] = x;
+ }
- if (context->private_tmp && !context->tmp_dir && !context->var_tmp_dir) {
- r = setup_tmpdirs(&context->tmp_dir, &context->var_tmp_dir);
- if (r < 0)
- return r;
+ if (shell) {
+ x = strappend("SHELL=", shell);
+ if (!x)
+ return -ENOMEM;
+ our_env[n_env++] = x;
}
- pid = fork();
- if (pid < 0)
- return -errno;
+ if (is_terminal_input(c->std_input) ||
+ c->std_output == EXEC_OUTPUT_TTY ||
+ c->std_error == EXEC_OUTPUT_TTY ||
+ c->tty_path) {
- if (pid == 0) {
- int i, err;
- sigset_t ss;
- const char *username = NULL, *home = NULL, *shell = NULL;
- uid_t uid = (uid_t) -1;
- gid_t gid = (gid_t) -1;
- _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL,
- **final_env = NULL, **final_argv = NULL;
- unsigned n_env = 0;
-
- /* child */
-
- rename_process_from_path(command->path);
-
- /* We reset exactly these signals, since they are the
- * only ones we set to SIG_IGN in the main daemon. All
- * others we leave untouched because we set them to
- * SIG_DFL or a valid handler initially, both of which
- * will be demoted to SIG_DFL. */
- default_signals(SIGNALS_CRASH_HANDLER,
- SIGNALS_IGNORE, -1);
-
- if (context->ignore_sigpipe)
- ignore_signals(SIGPIPE, -1);
-
- assert_se(sigemptyset(&ss) == 0);
- if (sigprocmask(SIG_SETMASK, &ss, NULL) < 0) {
- err = -errno;
- r = EXIT_SIGNAL_MASK;
- goto fail_child;
+ x = strdup(default_term_for_tty(tty_path(c)));
+ if (!x)
+ return -ENOMEM;
+ our_env[n_env++] = x;
+ }
+
+ our_env[n_env++] = NULL;
+ assert(n_env <= 10);
+
+ *ret = our_env;
+ our_env = NULL;
+
+ return 0;
+}
+
+static int exec_child(ExecCommand *command,
+ const ExecContext *context,
+ const ExecParameters *params,
+ ExecRuntime *runtime,
+ char **argv,
+ int socket_fd,
+ int *fds, unsigned n_fds,
+ char **files_env,
+ int *error) {
+
+ _cleanup_strv_free_ char **our_env = NULL, **pam_env = NULL, **final_env = NULL, **final_argv = NULL;
+ _cleanup_free_ char *mac_selinux_context_net = NULL;
+ const char *username = NULL, *home = NULL, *shell = NULL;
+ unsigned n_dont_close = 0;
+ int dont_close[n_fds + 4];
+ uid_t uid = UID_INVALID;
+ gid_t gid = GID_INVALID;
+ int i, err;
+
+ assert(command);
+ assert(context);
+ assert(params);
+ assert(error);
+
+ rename_process_from_path(command->path);
+
+ /* We reset exactly these signals, since they are the
+ * only ones we set to SIG_IGN in the main daemon. All
+ * others we leave untouched because we set them to
+ * SIG_DFL or a valid handler initially, both of which
+ * will be demoted to SIG_DFL. */
+ default_signals(SIGNALS_CRASH_HANDLER,
+ SIGNALS_IGNORE, -1);
+
+ if (context->ignore_sigpipe)
+ ignore_signals(SIGPIPE, -1);
+
+ err = reset_signal_mask();
+ if (err < 0) {
+ *error = EXIT_SIGNAL_MASK;
+ return err;
+ }
+
+ if (params->idle_pipe)
+ do_idle_pipe_dance(params->idle_pipe);
+
+ /* Close sockets very early to make sure we don't
+ * block init reexecution because it cannot bind its
+ * sockets */
+ log_forget_fds();
+
+ if (socket_fd >= 0)
+ dont_close[n_dont_close++] = socket_fd;
+ if (n_fds > 0) {
+ memcpy(dont_close + n_dont_close, fds, sizeof(int) * n_fds);
+ n_dont_close += n_fds;
+ }
+ if (params->bus_endpoint_fd >= 0)
+ dont_close[n_dont_close++] = params->bus_endpoint_fd;
+ if (runtime) {
+ if (runtime->netns_storage_socket[0] >= 0)
+ dont_close[n_dont_close++] = runtime->netns_storage_socket[0];
+ if (runtime->netns_storage_socket[1] >= 0)
+ dont_close[n_dont_close++] = runtime->netns_storage_socket[1];
+ }
+
+ err = close_all_fds(dont_close, n_dont_close);
+ if (err < 0) {
+ *error = EXIT_FDS;
+ return err;
+ }
+
+ if (!context->same_pgrp)
+ if (setsid() < 0) {
+ *error = EXIT_SETSID;
+ return -errno;
}
- if (idle_pipe)
- do_idle_pipe_dance(idle_pipe);
+ exec_context_tty_reset(context);
+
+ if (params->confirm_spawn) {
+ char response;
+
+ err = ask_for_confirmation(&response, argv);
+ if (err == -ETIMEDOUT)
+ write_confirm_message("Confirmation question timed out, assuming positive response.\n");
+ else if (err < 0)
+ write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
+ else if (response == 's') {
+ write_confirm_message("Skipping execution.\n");
+ *error = EXIT_CONFIRM;
+ return -ECANCELED;
+ } else if (response == 'n') {
+ write_confirm_message("Failing execution.\n");
+ *error = 0;
+ return 0;
+ }
+ }
+
+ /* If a socket is connected to STDIN/STDOUT/STDERR, we
+ * must sure to drop O_NONBLOCK */
+ if (socket_fd >= 0)
+ fd_nonblock(socket_fd, false);
+
+ err = setup_input(context, socket_fd, params->apply_tty_stdin);
+ if (err < 0) {
+ *error = EXIT_STDIN;
+ return err;
+ }
+
+ err = setup_output(context, STDOUT_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);
+ if (err < 0) {
+ *error = EXIT_STDOUT;
+ return err;
+ }
+
+ err = setup_output(context, STDERR_FILENO, socket_fd, basename(command->path), params->unit_id, params->apply_tty_stdin);
+ if (err < 0) {
+ *error = EXIT_STDERR;
+ return err;
+ }
- /* Close sockets very early to make sure we don't
- * block init reexecution because it cannot bind its
- * sockets */
- log_forget_fds();
- err = close_all_fds(socket_fd >= 0 ? &socket_fd : fds,
- socket_fd >= 0 ? 1 : n_fds);
+ if (params->cgroup_path) {
+ err = cg_attach_everywhere(params->cgroup_supported, params->cgroup_path, 0, NULL, NULL);
if (err < 0) {
- r = EXIT_FDS;
- goto fail_child;
+ *error = EXIT_CGROUP;
+ return err;
}
+ }
- if (!context->same_pgrp)
- if (setsid() < 0) {
- err = -errno;
- r = EXIT_SETSID;
- goto fail_child;
- }
+ if (context->oom_score_adjust_set) {
+ char t[16];
- if (context->tcpwrap_name) {
- if (socket_fd >= 0)
- if (!socket_tcpwrap(socket_fd, context->tcpwrap_name)) {
- err = -EACCES;
- r = EXIT_TCPWRAP;
- goto fail_child;
- }
+ snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
+ char_array_0(t);
- for (i = 0; i < (int) n_fds; i++) {
- if (!socket_tcpwrap(fds[i], context->tcpwrap_name)) {
- err = -EACCES;
- r = EXIT_TCPWRAP;
- goto fail_child;
- }
- }
+ if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
+ *error = EXIT_OOM_ADJUST;
+ return -errno;
}
+ }
- exec_context_tty_reset(context);
-
- if (confirm_spawn) {
- char response;
-
- err = ask_for_confirmation(&response, argv);
- if (err == -ETIMEDOUT)
- write_confirm_message("Confirmation question timed out, assuming positive response.\n");
- else if (err < 0)
- write_confirm_message("Couldn't ask confirmation question, assuming positive response: %s\n", strerror(-err));
- else if (response == 's') {
- write_confirm_message("Skipping execution.\n");
- err = -ECANCELED;
- r = EXIT_CONFIRM;
- goto fail_child;
- } else if (response == 'n') {
- write_confirm_message("Failing execution.\n");
- err = r = 0;
- goto fail_child;
- }
+ if (context->nice_set)
+ if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
+ *error = EXIT_NICE;
+ return -errno;
}
- /* If a socket is connected to STDIN/STDOUT/STDERR, we
- * must sure to drop O_NONBLOCK */
- if (socket_fd >= 0)
- fd_nonblock(socket_fd, false);
+ if (context->cpu_sched_set) {
+ struct sched_param param = {
+ .sched_priority = context->cpu_sched_priority,
+ };
- err = setup_input(context, socket_fd, apply_tty_stdin);
+ err = sched_setscheduler(0,
+ context->cpu_sched_policy |
+ (context->cpu_sched_reset_on_fork ?
+ SCHED_RESET_ON_FORK : 0),
+ ¶m);
if (err < 0) {
- r = EXIT_STDIN;
- goto fail_child;
+ *error = EXIT_SETSCHEDULER;
+ return -errno;
}
+ }
- err = setup_output(context, STDOUT_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
- if (err < 0) {
- r = EXIT_STDOUT;
- goto fail_child;
+ if (context->cpuset)
+ if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
+ *error = EXIT_CPUAFFINITY;
+ return -errno;
}
- err = setup_output(context, STDERR_FILENO, socket_fd, path_get_file_name(command->path), unit_id, apply_tty_stdin);
- if (err < 0) {
- r = EXIT_STDERR;
- goto fail_child;
+ if (context->ioprio_set)
+ if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
+ *error = EXIT_IOPRIO;
+ return -errno;
}
- if (cgroup_path) {
- err = cg_attach_everywhere(cgroup_supported, cgroup_path, 0);
- if (err < 0) {
- r = EXIT_CGROUP;
- goto fail_child;
- }
+ if (context->timer_slack_nsec != NSEC_INFINITY)
+ if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
+ *error = EXIT_TIMERSLACK;
+ return -errno;
}
- if (context->oom_score_adjust_set) {
- char t[16];
+ if (context->personality != 0xffffffffUL)
+ if (personality(context->personality) < 0) {
+ *error = EXIT_PERSONALITY;
+ return -errno;
+ }
- snprintf(t, sizeof(t), "%i", context->oom_score_adjust);
- char_array_0(t);
+ if (context->utmp_id)
+ utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
- if (write_string_file("/proc/self/oom_score_adj", t) < 0) {
- err = -errno;
- r = EXIT_OOM_ADJUST;
- goto fail_child;
- }
+ if (context->user) {
+ username = context->user;
+ err = get_user_creds(&username, &uid, &gid, &home, &shell);
+ if (err < 0) {
+ *error = EXIT_USER;
+ return err;
}
- if (context->nice_set)
- if (setpriority(PRIO_PROCESS, 0, context->nice) < 0) {
- err = -errno;
- r = EXIT_NICE;
- goto fail_child;
+ if (is_terminal_input(context->std_input)) {
+ err = chown_terminal(STDIN_FILENO, uid);
+ if (err < 0) {
+ *error = EXIT_STDIN;
+ return err;
}
+ }
+ }
- if (context->cpu_sched_set) {
- struct sched_param param = {
- .sched_priority = context->cpu_sched_priority,
- };
+#ifdef ENABLE_KDBUS
+ if (params->bus_endpoint_fd >= 0 && context->bus_endpoint) {
+ uid_t ep_uid = (uid == UID_INVALID) ? 0 : uid;
- r = sched_setscheduler(0,
- context->cpu_sched_policy |
- (context->cpu_sched_reset_on_fork ?
- SCHED_RESET_ON_FORK : 0),
- ¶m);
- if (r < 0) {
- err = -errno;
- r = EXIT_SETSCHEDULER;
- goto fail_child;
- }
+ err = bus_kernel_set_endpoint_policy(params->bus_endpoint_fd, ep_uid, context->bus_endpoint);
+ if (err < 0) {
+ *error = EXIT_BUS_ENDPOINT;
+ return err;
}
+ }
+#endif
- if (context->cpuset)
- if (sched_setaffinity(0, CPU_ALLOC_SIZE(context->cpuset_ncpus), context->cpuset) < 0) {
- err = -errno;
- r = EXIT_CPUAFFINITY;
- goto fail_child;
- }
-
- if (context->ioprio_set)
- if (ioprio_set(IOPRIO_WHO_PROCESS, 0, context->ioprio) < 0) {
- err = -errno;
- r = EXIT_IOPRIO;
- goto fail_child;
- }
+ /* If delegation is enabled we'll pass ownership of the cgroup
+ * (but only in systemd's own controller hierarchy!) to the
+ * user of the new process. */
+ if (params->cgroup_path && context->user && params->cgroup_delegate) {
+ err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0644, uid, gid);
+ if (err < 0) {
+ *error = EXIT_CGROUP;
+ return err;
+ }
- if (context->timer_slack_nsec != (nsec_t) -1)
- if (prctl(PR_SET_TIMERSLACK, context->timer_slack_nsec) < 0) {
- err = -errno;
- r = EXIT_TIMERSLACK;
- goto fail_child;
- }
- if (context->utmp_id)
- utmp_put_init_process(context->utmp_id, getpid(), getsid(0), context->tty_path);
+ err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, 0755, uid, gid);
+ if (err < 0) {
+ *error = EXIT_CGROUP;
+ return err;
+ }
+ }
- if (context->user) {
- username = context->user;
- err = get_user_creds(&username, &uid, &gid, &home, &shell);
- if (err < 0) {
- r = EXIT_USER;
- goto fail_child;
- }
+ if (!strv_isempty(context->runtime_directory) && params->runtime_prefix) {
+ char **rt;
- if (is_terminal_input(context->std_input)) {
- err = chown_terminal(STDIN_FILENO, uid);
- if (err < 0) {
- r = EXIT_STDIN;
- goto fail_child;
- }
- }
- }
+ STRV_FOREACH(rt, context->runtime_directory) {
+ _cleanup_free_ char *p;
-#ifdef HAVE_PAM
- if (cgroup_path && context->user && context->pam_name) {
- err = cg_set_task_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0644, uid, gid);
- if (err < 0) {
- r = EXIT_CGROUP;
- goto fail_child;
+ p = strjoin(params->runtime_prefix, "/", *rt, NULL);
+ if (!p) {
+ *error = EXIT_RUNTIME_DIRECTORY;
+ return -ENOMEM;
}
-
- err = cg_set_group_access(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, 0755, uid, gid);
+ err = mkdir_safe(p, context->runtime_directory_mode, uid, gid);
if (err < 0) {
- r = EXIT_CGROUP;
- goto fail_child;
+ *error = EXIT_RUNTIME_DIRECTORY;
+ return err;
}
}
-#endif
+ }
- if (apply_permissions) {
- err = enforce_groups(context, username, gid);
- if (err < 0) {
- r = EXIT_GROUP;
- goto fail_child;
- }
+ if (params->apply_permissions) {
+ err = enforce_groups(context, username, gid);
+ if (err < 0) {
+ *error = EXIT_GROUP;
+ return err;
}
+ }
- umask(context->umask);
+ umask(context->umask);
#ifdef HAVE_PAM
- if (apply_permissions && context->pam_name && username) {
- err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
- if (err < 0) {
- r = EXIT_PAM;
- goto fail_child;
- }
+ if (params->apply_permissions && context->pam_name && username) {
+ err = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
+ if (err < 0) {
+ *error = EXIT_PAM;
+ return err;
}
+ }
#endif
- if (context->private_network) {
- if (unshare(CLONE_NEWNET) < 0) {
- err = -errno;
- r = EXIT_NETWORK;
- goto fail_child;
- }
- loopback_setup();
+ if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
+ err = setup_netns(runtime->netns_storage_socket);
+ if (err < 0) {
+ *error = EXIT_NETWORK;
+ return err;
}
+ }
- if (strv_length(context->read_write_dirs) > 0 ||
- strv_length(context->read_only_dirs) > 0 ||
- strv_length(context->inaccessible_dirs) > 0 ||
- context->mount_flags != 0 ||
- context->private_tmp) {
- err = setup_namespace(context->read_write_dirs,
- context->read_only_dirs,
- context->inaccessible_dirs,
- context->tmp_dir,
- context->var_tmp_dir,
- context->private_tmp,
- context->mount_flags);
- if (err < 0) {
- r = EXIT_NAMESPACE;
- goto fail_child;
- }
+ if (!strv_isempty(context->read_write_dirs) ||
+ !strv_isempty(context->read_only_dirs) ||
+ !strv_isempty(context->inaccessible_dirs) ||
+ context->mount_flags != 0 ||
+ (context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
+ params->bus_endpoint_path ||
+ context->private_devices ||
+ context->protect_system != PROTECT_SYSTEM_NO ||
+ context->protect_home != PROTECT_HOME_NO) {
+
+ char *tmp = NULL, *var = NULL;
+
+ /* The runtime struct only contains the parent
+ * of the private /tmp, which is
+ * non-accessible to world users. Inside of it
+ * there's a /tmp that is sticky, and that's
+ * the one we want to use here. */
+
+ if (context->private_tmp && runtime) {
+ if (runtime->tmp_dir)
+ tmp = strappenda(runtime->tmp_dir, "/tmp");
+ if (runtime->var_tmp_dir)
+ var = strappenda(runtime->var_tmp_dir, "/tmp");
}
- if (apply_chroot) {
- if (context->root_directory)
- if (chroot(context->root_directory) < 0) {
- err = -errno;
- r = EXIT_CHROOT;
- goto fail_child;
- }
+ err = setup_namespace(
+ context->read_write_dirs,
+ context->read_only_dirs,
+ context->inaccessible_dirs,
+ tmp,
+ var,
+ params->bus_endpoint_path,
+ context->private_devices,
+ context->protect_home,
+ context->protect_system,
+ context->mount_flags);
+
+ if (err == -EPERM)
+ log_unit_warning_errno(params->unit_id, err, "Failed to set up file system namespace due to lack of privileges. Execution sandbox will not be in effect: %m");
+ else if (err < 0) {
+ *error = EXIT_NAMESPACE;
+ return err;
+ }
+ }
- if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
- err = -errno;
- r = EXIT_CHDIR;
- goto fail_child;
- }
- } else {
- _cleanup_free_ char *d = NULL;
-
- if (asprintf(&d, "%s/%s",
- context->root_directory ? context->root_directory : "",
- context->working_directory ? context->working_directory : "") < 0) {
- err = -ENOMEM;
- r = EXIT_MEMORY;
- goto fail_child;
+ if (params->apply_chroot) {
+ if (context->root_directory)
+ if (chroot(context->root_directory) < 0) {
+ *error = EXIT_CHROOT;
+ return -errno;
}
- if (chdir(d) < 0) {
- err = -errno;
- r = EXIT_CHDIR;
- goto fail_child;
- }
+ if (chdir(context->working_directory ? context->working_directory : "/") < 0) {
+ *error = EXIT_CHDIR;
+ return -errno;
+ }
+ } else {
+ _cleanup_free_ char *d = NULL;
+
+ if (asprintf(&d, "%s/%s",
+ context->root_directory ? context->root_directory : "",
+ context->working_directory ? context->working_directory : "") < 0) {
+ *error = EXIT_MEMORY;
+ return -ENOMEM;
}
- /* We repeat the fd closing here, to make sure that
- * nothing is leaked from the PAM modules */
- err = close_all_fds(fds, n_fds);
- if (err >= 0)
- err = shift_fds(fds, n_fds);
- if (err >= 0)
- err = flags_fds(fds, n_fds, context->non_blocking);
+ if (chdir(d) < 0) {
+ *error = EXIT_CHDIR;
+ return -errno;
+ }
+ }
+
+#ifdef HAVE_SELINUX
+ if (params->apply_permissions && mac_selinux_use() && params->selinux_context_net && socket_fd >= 0) {
+ err = mac_selinux_get_child_mls_label(socket_fd, command->path, context->selinux_context, &mac_selinux_context_net);
if (err < 0) {
- r = EXIT_FDS;
- goto fail_child;
+ *error = EXIT_SELINUX_CONTEXT;
+ return err;
}
+ }
+#endif
- if (apply_permissions) {
+ /* We repeat the fd closing here, to make sure that
+ * nothing is leaked from the PAM modules. Note that
+ * we are more aggressive this time since socket_fd
+ * and the netns fds we don't need anymore. The custom
+ * endpoint fd was needed to upload the policy and can
+ * now be closed as well. */
+ err = close_all_fds(fds, n_fds);
+ if (err >= 0)
+ err = shift_fds(fds, n_fds);
+ if (err >= 0)
+ err = flags_fds(fds, n_fds, context->non_blocking);
+ if (err < 0) {
+ *error = EXIT_FDS;
+ return err;
+ }
- for (i = 0; i < RLIMIT_NLIMITS; i++) {
- if (!context->rlimit[i])
- continue;
+ if (params->apply_permissions) {
- if (setrlimit_closest(i, context->rlimit[i]) < 0) {
- err = -errno;
- r = EXIT_LIMITS;
- goto fail_child;
- }
- }
+ for (i = 0; i < _RLIMIT_MAX; i++) {
+ if (!context->rlimit[i])
+ continue;
- if (context->capability_bounding_set_drop) {
- err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
- if (err < 0) {
- r = EXIT_CAPABILITIES;
- goto fail_child;
- }
+ if (setrlimit_closest(i, context->rlimit[i]) < 0) {
+ *error = EXIT_LIMITS;
+ return -errno;
}
+ }
- if (context->user) {
- err = enforce_user(context, uid);
- if (err < 0) {
- r = EXIT_USER;
- goto fail_child;
- }
+ if (context->capability_bounding_set_drop) {
+ err = capability_bounding_set_drop(context->capability_bounding_set_drop, false);
+ if (err < 0) {
+ *error = EXIT_CAPABILITIES;
+ return err;
}
+ }
- /* PR_GET_SECUREBITS is not privileged, while
- * PR_SET_SECUREBITS is. So to suppress
- * potential EPERMs we'll try not to call
- * PR_SET_SECUREBITS unless necessary. */
- if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
- if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
- err = -errno;
- r = EXIT_SECUREBITS;
- goto fail_child;
- }
+#ifdef HAVE_SMACK
+ if (context->smack_process_label) {
+ err = mac_smack_apply_pid(0, context->smack_process_label);
+ if (err < 0) {
+ *error = EXIT_SMACK_PROCESS_LABEL;
+ return err;
+ }
+ }
+#endif
- if (context->capabilities)
- if (cap_set_proc(context->capabilities) < 0) {
- err = -errno;
- r = EXIT_CAPABILITIES;
- goto fail_child;
- }
+ if (context->user) {
+ err = enforce_user(context, uid);
+ if (err < 0) {
+ *error = EXIT_USER;
+ return err;
+ }
+ }
- if (context->no_new_privileges)
- if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
- err = -errno;
- r = EXIT_NO_NEW_PRIVILEGES;
- goto fail_child;
- }
+ /* PR_GET_SECUREBITS is not privileged, while
+ * PR_SET_SECUREBITS is. So to suppress
+ * potential EPERMs we'll try not to call
+ * PR_SET_SECUREBITS unless necessary. */
+ if (prctl(PR_GET_SECUREBITS) != context->secure_bits)
+ if (prctl(PR_SET_SECUREBITS, context->secure_bits) < 0) {
+ *error = EXIT_SECUREBITS;
+ return -errno;
+ }
- if (context->syscall_filter) {
- err = apply_seccomp(context->syscall_filter);
- if (err < 0) {
- r = EXIT_SECCOMP;
- goto fail_child;
- }
+ if (context->capabilities)
+ if (cap_set_proc(context->capabilities) < 0) {
+ *error = EXIT_CAPABILITIES;
+ return -errno;
+ }
+
+ if (context->no_new_privileges)
+ if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+ *error = EXIT_NO_NEW_PRIVILEGES;
+ return -errno;
}
- }
- our_env = new(char*, 8);
- if (!our_env ||
- (n_fds > 0 && (
- asprintf(our_env + n_env++, "LISTEN_PID=%lu", (unsigned long) getpid()) < 0 ||
- asprintf(our_env + n_env++, "LISTEN_FDS=%u", n_fds) < 0)) ||
- (home && asprintf(our_env + n_env++, "HOME=%s", home) < 0) ||
- (username && (
- asprintf(our_env + n_env++, "LOGNAME=%s", username) < 0 ||
- asprintf(our_env + n_env++, "USER=%s", username) < 0)) ||
- (shell && asprintf(our_env + n_env++, "SHELL=%s", shell) < 0) ||
- ((is_terminal_input(context->std_input) ||
- context->std_output == EXEC_OUTPUT_TTY ||
- context->std_error == EXEC_OUTPUT_TTY) && (
- !(our_env[n_env++] = strdup(default_term_for_tty(tty_path(context))))))) {
-
- err = -ENOMEM;
- r = EXIT_MEMORY;
- goto fail_child;
+#ifdef HAVE_SECCOMP
+ if (context->address_families_whitelist ||
+ !set_isempty(context->address_families)) {
+ err = apply_address_families(context);
+ if (err < 0) {
+ *error = EXIT_ADDRESS_FAMILIES;
+ return err;
+ }
}
- our_env[n_env++] = NULL;
- assert(n_env <= 8);
-
- final_env = strv_env_merge(5,
- environment,
- our_env,
- context->environment,
- files_env,
- pam_env,
- NULL);
- if (!final_env) {
- err = -ENOMEM;
- r = EXIT_MEMORY;
- goto fail_child;
+ if (context->syscall_whitelist ||
+ !set_isempty(context->syscall_filter) ||
+ !set_isempty(context->syscall_archs)) {
+ err = apply_seccomp(context);
+ if (err < 0) {
+ *error = EXIT_SECCOMP;
+ return err;
+ }
}
+#endif
+
+#ifdef HAVE_SELINUX
+ if (mac_selinux_use()) {
+ char *exec_context = mac_selinux_context_net ?: context->selinux_context;
- final_argv = replace_env_argv(argv, final_env);
- if (!final_argv) {
- err = -ENOMEM;
- r = EXIT_MEMORY;
- goto fail_child;
+ if (exec_context) {
+ err = setexeccon(exec_context);
+ if (err < 0) {
+ *error = EXIT_SELINUX_CONTEXT;
+ return err;
+ }
+ }
}
+#endif
- final_env = strv_env_clean(final_env);
-
- if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
- line = exec_command_line(final_argv);
- if (line) {
- log_open();
- log_struct_unit(LOG_DEBUG,
- unit_id,
- "EXECUTABLE=%s", command->path,
- "MESSAGE=Executing: %s", line,
- NULL);
- log_close();
- free(line);
- line = NULL;
+#ifdef HAVE_APPARMOR
+ if (context->apparmor_profile && mac_apparmor_use()) {
+ err = aa_change_onexec(context->apparmor_profile);
+ if (err < 0 && !context->apparmor_profile_ignore) {
+ *error = EXIT_APPARMOR_PROFILE;
+ return -errno;
}
}
- execve(command->path, final_argv, final_env);
- err = -errno;
- r = EXIT_EXEC;
+#endif
+ }
+
+ err = build_environment(context, n_fds, params->watchdog_usec, home, username, shell, &our_env);
+ if (err < 0) {
+ *error = EXIT_MEMORY;
+ return err;
+ }
+
+ final_env = strv_env_merge(5,
+ params->environment,
+ our_env,
+ context->environment,
+ files_env,
+ pam_env,
+ NULL);
+ if (!final_env) {
+ *error = EXIT_MEMORY;
+ return -ENOMEM;
+ }
+
+ final_argv = replace_env_argv(argv, final_env);
+ if (!final_argv) {
+ *error = EXIT_MEMORY;
+ return -ENOMEM;
+ }
+
+ final_env = strv_env_clean(final_env);
+
+ if (_unlikely_(log_get_max_level() >= LOG_PRI(LOG_DEBUG))) {
+ _cleanup_free_ char *line;
+
+ line = exec_command_line(final_argv);
+ if (line) {
+ log_open();
+ log_unit_struct(params->unit_id,
+ LOG_DEBUG,
+ "EXECUTABLE=%s", command->path,
+ LOG_MESSAGE("Executing: %s", line),
+ NULL);
+ log_close();
+ }
+ }
+ execve(command->path, final_argv, final_env);
+ *error = EXIT_EXEC;
+ return -errno;
+}
+
+int exec_spawn(ExecCommand *command,
+ const ExecContext *context,
+ const ExecParameters *params,
+ ExecRuntime *runtime,
+ pid_t *ret) {
+
+ _cleanup_strv_free_ char **files_env = NULL;
+ int *fds = NULL; unsigned n_fds = 0;
+ char *line, **argv;
+ int socket_fd;
+ pid_t pid;
+ int err;
+
+ assert(command);
+ assert(context);
+ assert(ret);
+ assert(params);
+ assert(params->fds || params->n_fds <= 0);
+
+ if (context->std_input == EXEC_INPUT_SOCKET ||
+ context->std_output == EXEC_OUTPUT_SOCKET ||
+ context->std_error == EXEC_OUTPUT_SOCKET) {
+
+ if (params->n_fds != 1)
+ return -EINVAL;
+
+ socket_fd = params->fds[0];
+ } else {
+ socket_fd = -1;
+ fds = params->fds;
+ n_fds = params->n_fds;
+ }
+
+ err = exec_context_load_environment(context, params->unit_id, &files_env);
+ if (err < 0) {
+ log_unit_struct(params->unit_id,
+ LOG_ERR,
+ LOG_MESSAGE("Failed to load environment files: %s", strerror(-err)),
+ LOG_ERRNO(-err),
+ NULL);
+ return err;
+ }
- fail_child:
+ argv = params->argv ?: command->argv;
+
+ line = exec_command_line(argv);
+ if (!line)
+ return log_oom();
+
+ log_unit_struct(params->unit_id,
+ LOG_DEBUG,
+ "EXECUTABLE=%s", command->path,
+ LOG_MESSAGE("About to execute: %s", line),
+ NULL);
+ free(line);
+
+ pid = fork();
+ if (pid < 0)
+ return -errno;
+
+ if (pid == 0) {
+ int r;
+
+ err = exec_child(command,
+ context,
+ params,
+ runtime,
+ argv,
+ socket_fd,
+ fds, n_fds,
+ files_env,
+ &r);
if (r != 0) {
log_open();
- log_struct(LOG_ERR, MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
+ log_struct(LOG_ERR,
+ LOG_MESSAGE_ID(SD_MESSAGE_SPAWN_FAILED),
"EXECUTABLE=%s", command->path,
- "MESSAGE=Failed at step %s spawning %s: %s",
- exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
- command->path, strerror(-err),
- "ERRNO=%d", -err,
+ LOG_MESSAGE("Failed at step %s spawning %s: %s",
+ exit_status_to_string(r, EXIT_STATUS_SYSTEMD),
+ command->path, strerror(-err)),
+ LOG_ERRNO(-err),
NULL);
log_close();
}
_exit(r);
}
- log_struct_unit(LOG_DEBUG,
- unit_id,
- "MESSAGE=Forked %s as %lu",
- command->path, (unsigned long) pid,
+ log_unit_struct(params->unit_id,
+ LOG_DEBUG,
+ LOG_MESSAGE("Forked %s as "PID_FMT,
+ command->path, pid),
NULL);
/* We add the new process to the cgroup both in the child (so
* outside of the cgroup) and in the parent (so that we can be
* sure that when we kill the cgroup the process will be
* killed too). */
- if (cgroup_path)
- cg_attach(SYSTEMD_CGROUP_CONTROLLER, cgroup_path, pid);
+ if (params->cgroup_path)
+ cg_attach(SYSTEMD_CGROUP_CONTROLLER, params->cgroup_path, pid);
exec_status_start(&command->exec_status, pid);
c->syslog_priority = LOG_DAEMON|LOG_INFO;
c->syslog_level_prefix = true;
c->ignore_sigpipe = true;
- c->timer_slack_nsec = (nsec_t) -1;
+ c->timer_slack_nsec = NSEC_INFINITY;
+ c->personality = 0xffffffffUL;
+ c->runtime_directory_mode = 0755;
}
-static void *remove_tmpdir_thread(void *p) {
- int r;
- _cleanup_free_ char *dirp = p;
- char *dir;
-
- assert(dirp);
-
- r = rm_rf_dangerous(dirp, false, true, false);
- dir = dirname(dirp);
- if (r < 0)
- log_warning("Failed to remove content of temporary directory %s: %s",
- dir, strerror(-r));
- else {
- r = rmdir(dir);
- if (r < 0)
- log_warning("Failed to remove temporary directory %s: %s",
- dir, strerror(-r));
- }
-
- return NULL;
-}
-
-void exec_context_tmp_dirs_done(ExecContext *c) {
- char* dirs[] = {c->tmp_dir ? c->tmp_dir : c->var_tmp_dir,
- c->tmp_dir ? c->var_tmp_dir : NULL,
- NULL};
- char **dirp;
-
- for(dirp = dirs; *dirp; dirp++) {
- log_debug("Spawning thread to nuke %s", *dirp);
- asynchronous_job(remove_tmpdir_thread, *dirp);
- }
-
- c->tmp_dir = c->var_tmp_dir = NULL;
-}
-
-void exec_context_done(ExecContext *c, bool reloading_or_reexecuting) {
+void exec_context_done(ExecContext *c) {
unsigned l;
assert(c);
free(c->tty_path);
c->tty_path = NULL;
- free(c->tcpwrap_name);
- c->tcpwrap_name = NULL;
-
free(c->syslog_identifier);
c->syslog_identifier = NULL;
free(c->utmp_id);
c->utmp_id = NULL;
- free(c->syscall_filter);
+ free(c->selinux_context);
+ c->selinux_context = NULL;
+
+ free(c->apparmor_profile);
+ c->apparmor_profile = NULL;
+
+ set_free(c->syscall_filter);
c->syscall_filter = NULL;
- if (!reloading_or_reexecuting)
- exec_context_tmp_dirs_done(c);
+ set_free(c->syscall_archs);
+ c->syscall_archs = NULL;
+
+ set_free(c->address_families);
+ c->address_families = NULL;
+
+ strv_free(c->runtime_directory);
+ c->runtime_directory = NULL;
+
+ bus_endpoint_free(c->bus_endpoint);
+ c->bus_endpoint = NULL;
+}
+
+int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_prefix) {
+ char **i;
+
+ assert(c);
+
+ if (!runtime_prefix)
+ return 0;
+
+ STRV_FOREACH(i, c->runtime_directory) {
+ _cleanup_free_ char *p;
+
+ p = strjoin(runtime_prefix, "/", *i, NULL);
+ if (!p)
+ return -ENOMEM;
+
+ /* We execute this synchronously, since we need to be
+ * sure this is gone when we start the service
+ * next. */
+ rm_rf_dangerous(p, false, true, false);
+ }
+
+ return 0;
}
void exec_command_done(ExecCommand *c) {
ExecCommand *i;
while ((i = c)) {
- LIST_REMOVE(ExecCommand, command, c, i);
+ LIST_REMOVE(command, c, i);
exec_command_done(i);
free(i);
}
}
}
-int exec_context_load_environment(const ExecContext *c, char ***l) {
+int exec_context_load_environment(const ExecContext *c, const char *unit_id, char ***l) {
char **i, **r = NULL;
assert(c);
return -EINVAL;
}
for (n = 0; n < count; n++) {
- k = load_env_file(pglob.gl_pathv[n], NULL, &p);
+ k = load_env_file(NULL, pglob.gl_pathv[n], NULL, &p);
if (k < 0) {
if (ignore)
continue;
}
/* Log invalid environment variables with filename */
if (p)
- p = strv_env_clean_log(p, pglob.gl_pathv[n]);
+ p = strv_env_clean_log(p, unit_id, pglob.gl_pathv[n]);
if (r == NULL)
r = p;
}
static bool tty_may_match_dev_console(const char *tty) {
- char *active = NULL, *console;
- bool b;
+ _cleanup_free_ char *active = NULL;
+ char *console;
if (startswith(tty, "/dev/"))
tty += 5;
return true;
/* "tty0" means the active VC, so it may be the same sometimes */
- b = streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
- free(active);
-
- return b;
+ return streq(console, tty) || (streq(console, "tty0") && tty_is_vc(tty));
}
bool exec_context_may_touch_console(ExecContext *ec) {
"%sNonBlocking: %s\n"
"%sPrivateTmp: %s\n"
"%sPrivateNetwork: %s\n"
+ "%sPrivateDevices: %s\n"
+ "%sProtectHome: %s\n"
+ "%sProtectSystem: %s\n"
"%sIgnoreSIGPIPE: %s\n",
prefix, c->umask,
prefix, c->working_directory ? c->working_directory : "/",
prefix, yes_no(c->non_blocking),
prefix, yes_no(c->private_tmp),
prefix, yes_no(c->private_network),
+ prefix, yes_no(c->private_devices),
+ prefix, protect_home_to_string(c->protect_home),
+ prefix, protect_system_to_string(c->protect_system),
prefix, yes_no(c->ignore_sigpipe));
STRV_FOREACH(e, c->environment)
STRV_FOREACH(e, c->environment_files)
fprintf(f, "%sEnvironmentFile: %s\n", prefix, *e);
- if (c->tcpwrap_name)
- fprintf(f,
- "%sTCPWrapName: %s\n",
- prefix, c->tcpwrap_name);
-
if (c->nice_set)
fprintf(f,
"%sNice: %i\n",
for (i = 0; i < RLIM_NLIMITS; i++)
if (c->rlimit[i])
- fprintf(f, "%s%s: %llu\n", prefix, rlimit_to_string(i), (unsigned long long) c->rlimit[i]->rlim_max);
+ fprintf(f, "%s%s: "RLIM_FMT"\n",
+ prefix, rlimit_to_string(i), c->rlimit[i]->rlim_max);
if (c->ioprio_set) {
- char *class_str;
- int r;
+ _cleanup_free_ char *class_str = NULL;
- r = ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
- if (r < 0)
- class_str = NULL;
+ ioprio_class_to_string_alloc(IOPRIO_PRIO_CLASS(c->ioprio), &class_str);
fprintf(f,
"%sIOSchedulingClass: %s\n"
"%sIOPriority: %i\n",
prefix, strna(class_str),
prefix, (int) IOPRIO_PRIO_DATA(c->ioprio));
- free(class_str);
}
if (c->cpu_sched_set) {
- char *policy_str;
- int r;
+ _cleanup_free_ char *policy_str = NULL;
- r = sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
- if (r < 0)
- policy_str = NULL;
+ sched_policy_to_string_alloc(c->cpu_sched_policy, &policy_str);
fprintf(f,
"%sCPUSchedulingPolicy: %s\n"
"%sCPUSchedulingPriority: %i\n"
prefix, strna(policy_str),
prefix, c->cpu_sched_priority,
prefix, yes_no(c->cpu_sched_reset_on_fork));
- free(policy_str);
}
if (c->cpuset) {
fprintf(f, "%sCPUAffinity:", prefix);
for (i = 0; i < c->cpuset_ncpus; i++)
if (CPU_ISSET_S(i, CPU_ALLOC_SIZE(c->cpuset_ncpus), c->cpuset))
- fprintf(f, " %i", i);
+ fprintf(f, " %u", i);
fputs("\n", f);
}
- if (c->timer_slack_nsec != (nsec_t) -1)
- fprintf(f, "%sTimerSlackNSec: %lu\n", prefix, (unsigned long)c->timer_slack_nsec);
+ if (c->timer_slack_nsec != NSEC_INFINITY)
+ fprintf(f, "%sTimerSlackNSec: "NSEC_FMT "\n", prefix, c->timer_slack_nsec);
fprintf(f,
"%sStandardInput: %s\n"
prefix, yes_no(c->tty_vhangup),
prefix, yes_no(c->tty_vt_disallocate));
- if (c->std_output == EXEC_OUTPUT_SYSLOG || c->std_output == EXEC_OUTPUT_KMSG || c->std_output == EXEC_OUTPUT_JOURNAL ||
- c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
- c->std_error == EXEC_OUTPUT_SYSLOG || c->std_error == EXEC_OUTPUT_KMSG || c->std_error == EXEC_OUTPUT_JOURNAL ||
- c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE || c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
- char *fac_str, *lvl_str;
- int r;
+ if (c->std_output == EXEC_OUTPUT_SYSLOG ||
+ c->std_output == EXEC_OUTPUT_KMSG ||
+ c->std_output == EXEC_OUTPUT_JOURNAL ||
+ c->std_output == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
+ c->std_output == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
+ c->std_output == EXEC_OUTPUT_JOURNAL_AND_CONSOLE ||
+ c->std_error == EXEC_OUTPUT_SYSLOG ||
+ c->std_error == EXEC_OUTPUT_KMSG ||
+ c->std_error == EXEC_OUTPUT_JOURNAL ||
+ c->std_error == EXEC_OUTPUT_SYSLOG_AND_CONSOLE ||
+ c->std_error == EXEC_OUTPUT_KMSG_AND_CONSOLE ||
+ c->std_error == EXEC_OUTPUT_JOURNAL_AND_CONSOLE) {
- r = log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
- if (r < 0)
- fac_str = NULL;
+ _cleanup_free_ char *fac_str = NULL, *lvl_str = NULL;
- r = log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
- if (r < 0)
- lvl_str = NULL;
+ log_facility_unshifted_to_string_alloc(c->syslog_priority >> 3, &fac_str);
+ log_level_to_string_alloc(LOG_PRI(c->syslog_priority), &lvl_str);
fprintf(f,
"%sSyslogFacility: %s\n"
"%sSyslogLevel: %s\n",
prefix, strna(fac_str),
prefix, strna(lvl_str));
- free(lvl_str);
- free(fac_str);
}
if (c->capabilities) {
- char *t;
- if ((t = cap_to_text(c->capabilities, NULL))) {
- fprintf(f, "%sCapabilities: %s\n",
- prefix, t);
- cap_free(t);
- }
+ _cleanup_cap_free_charp_ char *t;
+
+ t = cap_to_text(c->capabilities, NULL);
+ if (t)
+ fprintf(f, "%sCapabilities: %s\n", prefix, t);
}
if (c->secure_bits)
fprintf(f, "%sCapabilityBoundingSet:", prefix);
for (l = 0; l <= cap_last_cap(); l++)
- if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l))) {
- char *t;
-
- if ((t = cap_to_name(l))) {
- fprintf(f, " %s", t);
- cap_free(t);
- }
- }
+ if (!(c->capability_bounding_set_drop & ((uint64_t) 1ULL << (uint64_t) l)))
+ fprintf(f, " %s", strna(capability_to_name(l)));
fputs("\n", f);
}
fprintf(f,
"%sUtmpIdentifier: %s\n",
prefix, c->utmp_id);
+
+ if (c->selinux_context)
+ fprintf(f,
+ "%sSELinuxContext: %s%s\n",
+ prefix, c->selinux_context_ignore ? "-" : "", c->selinux_context);
+
+ if (c->personality != 0xffffffffUL)
+ fprintf(f,
+ "%sPersonality: %s\n",
+ prefix, strna(personality_to_string(c->personality)));
+
+ if (c->syscall_filter) {
+#ifdef HAVE_SECCOMP
+ Iterator j;
+ void *id;
+ bool first = true;
+#endif
+
+ fprintf(f,
+ "%sSystemCallFilter: ",
+ prefix);
+
+ if (!c->syscall_whitelist)
+ fputc('~', f);
+
+#ifdef HAVE_SECCOMP
+ SET_FOREACH(id, c->syscall_filter, j) {
+ _cleanup_free_ char *name = NULL;
+
+ if (first)
+ first = false;
+ else
+ fputc(' ', f);
+
+ name = seccomp_syscall_resolve_num_arch(SCMP_ARCH_NATIVE, PTR_TO_INT(id) - 1);
+ fputs(strna(name), f);
+ }
+#endif
+
+ fputc('\n', f);
+ }
+
+ if (c->syscall_archs) {
+#ifdef HAVE_SECCOMP
+ Iterator j;
+ void *id;
+#endif
+
+ fprintf(f,
+ "%sSystemCallArchitectures:",
+ prefix);
+
+#ifdef HAVE_SECCOMP
+ SET_FOREACH(id, c->syscall_archs, j)
+ fprintf(f, " %s", strna(seccomp_arch_to_string(PTR_TO_UINT32(id) - 1)));
+#endif
+ fputc('\n', f);
+ }
+
+ if (c->syscall_errno != 0)
+ fprintf(f,
+ "%sSystemCallErrorNumber: %s\n",
+ prefix, strna(errno_to_name(c->syscall_errno)));
+
+ if (c->apparmor_profile)
+ fprintf(f,
+ "%sAppArmorProfile: %s%s\n",
+ prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile);
+}
+
+bool exec_context_maintains_privileges(ExecContext *c) {
+ assert(c);
+
+ /* Returns true if the process forked off would run run under
+ * an unchanged UID or as root. */
+
+ if (!c->user)
+ return true;
+
+ if (streq(c->user, "root") || streq(c->user, "0"))
+ return true;
+
+ return false;
}
void exec_status_start(ExecStatus *s, pid_t pid) {
assert(s);
assert(f);
- if (!prefix)
- prefix = "";
-
if (s->pid <= 0)
return;
+ prefix = strempty(prefix);
+
fprintf(f,
- "%sPID: %lu\n",
- prefix, (unsigned long) s->pid);
+ "%sPID: "PID_FMT"\n",
+ prefix, s->pid);
if (s->start_timestamp.realtime > 0)
fprintf(f,
}
void exec_command_dump(ExecCommand *c, FILE *f, const char *prefix) {
- char *p2;
+ _cleanup_free_ char *cmd = NULL;
const char *prefix2;
- char *cmd;
-
assert(c);
assert(f);
- if (!prefix)
- prefix = "";
- p2 = strappend(prefix, "\t");
- prefix2 = p2 ? p2 : prefix;
+ prefix = strempty(prefix);
+ prefix2 = strappenda(prefix, "\t");
cmd = exec_command_line(c->argv);
-
fprintf(f,
"%sCommand Line: %s\n",
prefix, cmd ? cmd : strerror(ENOMEM));
- free(cmd);
-
exec_status_dump(&c->exec_status, f, prefix2);
-
- free(p2);
}
void exec_command_dump_list(ExecCommand *c, FILE *f, const char *prefix) {
assert(f);
- if (!prefix)
- prefix = "";
+ prefix = strempty(prefix);
LIST_FOREACH(command, c, c)
exec_command_dump(c, f, prefix);
if (*l) {
/* It's kind of important, that we keep the order here */
- LIST_FIND_TAIL(ExecCommand, command, *l, end);
- LIST_INSERT_AFTER(ExecCommand, command, *l, end, e);
+ LIST_FIND_TAIL(command, *l, end);
+ LIST_INSERT_AFTER(command, *l, end, e);
} else
*l = e;
}
if (!l)
return -ENOMEM;
- if (!(p = strdup(path))) {
+ p = strdup(path);
+ if (!p) {
strv_free(l);
return -ENOMEM;
}
return 0;
}
+int exec_command_append(ExecCommand *c, const char *path, ...) {
+ _cleanup_strv_free_ char **l = NULL;
+ va_list ap;
+ int r;
+
+ assert(c);
+ assert(path);
+
+ va_start(ap, path);
+ l = strv_new_ap(path, ap);
+ va_end(ap);
+
+ if (!l)
+ return -ENOMEM;
+
+ r = strv_extend_strv(&c->argv, l);
+ if (r < 0)
+ return r;
+
+ return 0;
+}
+
+
+static int exec_runtime_allocate(ExecRuntime **rt) {
+
+ if (*rt)
+ return 0;
+
+ *rt = new0(ExecRuntime, 1);
+ if (!*rt)
+ return -ENOMEM;
+
+ (*rt)->n_ref = 1;
+ (*rt)->netns_storage_socket[0] = (*rt)->netns_storage_socket[1] = -1;
+
+ return 0;
+}
+
+int exec_runtime_make(ExecRuntime **rt, ExecContext *c, const char *id) {
+ int r;
+
+ assert(rt);
+ assert(c);
+ assert(id);
+
+ if (*rt)
+ return 1;
+
+ if (!c->private_network && !c->private_tmp)
+ return 0;
+
+ r = exec_runtime_allocate(rt);
+ if (r < 0)
+ return r;
+
+ if (c->private_network && (*rt)->netns_storage_socket[0] < 0) {
+ if (socketpair(AF_UNIX, SOCK_DGRAM, 0, (*rt)->netns_storage_socket) < 0)
+ return -errno;
+ }
+
+ if (c->private_tmp && !(*rt)->tmp_dir) {
+ r = setup_tmp_dirs(id, &(*rt)->tmp_dir, &(*rt)->var_tmp_dir);
+ if (r < 0)
+ return r;
+ }
+
+ return 1;
+}
+
+ExecRuntime *exec_runtime_ref(ExecRuntime *r) {
+ assert(r);
+ assert(r->n_ref > 0);
+
+ r->n_ref++;
+ return r;
+}
+
+ExecRuntime *exec_runtime_unref(ExecRuntime *r) {
+
+ if (!r)
+ return NULL;
+
+ assert(r->n_ref > 0);
+
+ r->n_ref--;
+ if (r->n_ref <= 0) {
+ free(r->tmp_dir);
+ free(r->var_tmp_dir);
+ safe_close_pair(r->netns_storage_socket);
+ free(r);
+ }
+
+ return NULL;
+}
+
+int exec_runtime_serialize(ExecRuntime *rt, Unit *u, FILE *f, FDSet *fds) {
+ assert(u);
+ assert(f);
+ assert(fds);
+
+ if (!rt)
+ return 0;
+
+ if (rt->tmp_dir)
+ unit_serialize_item(u, f, "tmp-dir", rt->tmp_dir);
+
+ if (rt->var_tmp_dir)
+ unit_serialize_item(u, f, "var-tmp-dir", rt->var_tmp_dir);
+
+ if (rt->netns_storage_socket[0] >= 0) {
+ int copy;
+
+ copy = fdset_put_dup(fds, rt->netns_storage_socket[0]);
+ if (copy < 0)
+ return copy;
+
+ unit_serialize_item_format(u, f, "netns-socket-0", "%i", copy);
+ }
+
+ if (rt->netns_storage_socket[1] >= 0) {
+ int copy;
+
+ copy = fdset_put_dup(fds, rt->netns_storage_socket[1]);
+ if (copy < 0)
+ return copy;
+
+ unit_serialize_item_format(u, f, "netns-socket-1", "%i", copy);
+ }
+
+ return 0;
+}
+
+int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, const char *value, FDSet *fds) {
+ int r;
+
+ assert(rt);
+ assert(key);
+ assert(value);
+
+ if (streq(key, "tmp-dir")) {
+ char *copy;
+
+ r = exec_runtime_allocate(rt);
+ if (r < 0)
+ return r;
+
+ copy = strdup(value);
+ if (!copy)
+ return log_oom();
+
+ free((*rt)->tmp_dir);
+ (*rt)->tmp_dir = copy;
+
+ } else if (streq(key, "var-tmp-dir")) {
+ char *copy;
+
+ r = exec_runtime_allocate(rt);
+ if (r < 0)
+ return r;
+
+ copy = strdup(value);
+ if (!copy)
+ return log_oom();
+
+ free((*rt)->var_tmp_dir);
+ (*rt)->var_tmp_dir = copy;
+
+ } else if (streq(key, "netns-socket-0")) {
+ int fd;
+
+ r = exec_runtime_allocate(rt);
+ if (r < 0)
+ return r;
+
+ if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
+ log_unit_debug(u->id, "Failed to parse netns socket value %s", value);
+ else {
+ safe_close((*rt)->netns_storage_socket[0]);
+ (*rt)->netns_storage_socket[0] = fdset_remove(fds, fd);
+ }
+ } else if (streq(key, "netns-socket-1")) {
+ int fd;
+
+ r = exec_runtime_allocate(rt);
+ if (r < 0)
+ return r;
+
+ if (safe_atoi(value, &fd) < 0 || !fdset_contains(fds, fd))
+ log_unit_debug(u->id, "Failed to parse netns socket value %s", value);
+ else {
+ safe_close((*rt)->netns_storage_socket[1]);
+ (*rt)->netns_storage_socket[1] = fdset_remove(fds, fd);
+ }
+ } else
+ return 0;
+
+ return 1;
+}
+
+static void *remove_tmpdir_thread(void *p) {
+ _cleanup_free_ char *path = p;
+
+ rm_rf_dangerous(path, false, true, false);
+ return NULL;
+}
+
+void exec_runtime_destroy(ExecRuntime *rt) {
+ int r;
+
+ if (!rt)
+ return;
+
+ /* If there are multiple users of this, let's leave the stuff around */
+ if (rt->n_ref > 1)
+ return;
+
+ if (rt->tmp_dir) {
+ log_debug("Spawning thread to nuke %s", rt->tmp_dir);
+
+ r = asynchronous_job(remove_tmpdir_thread, rt->tmp_dir);
+ if (r < 0) {
+ log_warning_errno(r, "Failed to nuke %s: %m", rt->tmp_dir);
+ free(rt->tmp_dir);
+ }
+
+ rt->tmp_dir = NULL;
+ }
+
+ if (rt->var_tmp_dir) {
+ log_debug("Spawning thread to nuke %s", rt->var_tmp_dir);
+
+ r = asynchronous_job(remove_tmpdir_thread, rt->var_tmp_dir);
+ if (r < 0) {
+ log_warning_errno(r, "Failed to nuke %s: %m", rt->var_tmp_dir);
+ free(rt->var_tmp_dir);
+ }
+
+ rt->var_tmp_dir = NULL;
+ }
+
+ safe_close_pair(rt->netns_storage_socket);
+}
+
static const char* const exec_input_table[_EXEC_INPUT_MAX] = {
[EXEC_INPUT_NULL] = "null",
[EXEC_INPUT_TTY] = "tty",
~ianmdlvl / elogind.git / blobdiff